<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Franklin Gothic Book";
panose-1:2 11 5 3 2 1 2 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
p.MsoNoSpacing, li.MsoNoSpacing, div.MsoNoSpacing
{mso-style-priority:1;
margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
p.paragraph, li.paragraph, div.paragraph
{mso-style-name:paragraph;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.normaltextrun
{mso-style-name:normaltextrun;}
span.contextualspellingandgrammarerror
{mso-style-name:contextualspellingandgrammarerror;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">FYSA<o:p></o:p></p>
<p class="paragraph" style="mso-margin-top-alt:0in;margin-right:3.0pt;margin-bottom:0in;margin-left:0in;vertical-align:baseline">
<o:p> </o:p></p>
<p class="MsoNoSpacing"><span style="font-family:"Franklin Gothic Book",sans-serif">The Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), and Federal Bureau of Investigation (FBI) published a
<a href="http://www.cisa.gov/uscert/ncas/alerts/aa22-158a">joint Cybersecurity Advisory</a> about how the People’s Republic of China (PRC) state-sponsored cyber actors continue to exploit publicly known vulnerabilities in order to establish a broad infrastructure
network. These actors use the network to exploit a wide variety of targets worldwide, including public and private sector organizations.
<o:p></o:p></span></p>
<p class="MsoNoSpacing"><span style="font-family:"Franklin Gothic Book",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNoSpacing"><span style="font-family:"Franklin Gothic Book",sans-serif">The advisory titled, “People’s Republic of China State-Sponsored Cyber Actors Exploit Network Providers and Devices,” details the targeting and compromise of major telecommunications
companies and network service provider infrastructures and the top vulnerabilities—primarily Common Vulnerabilities and Exposures (CVEs)—associated with network devices routinely exploited by the cyber actors since 2020.
<o:p></o:p></span></p>
<p class="MsoNoSpacing"><span style="font-family:"Franklin Gothic Book",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNoSpacing"><span class="normaltextrun"><span style="font-family:"Franklin Gothic Book",sans-serif;color:#030303">PRC state-sponsored cyber actors readily exploit vulnerabilities to compromise unpatched network devices, such as Small Office/Home
Office (SOHO) routers and Network Attached Storage (NAS) devices, which serve as additional access points and act as midpoints to conduct network intrusions on other entities. These
</span></span><span class="normaltextrun"><span style="font-family:"Franklin Gothic Book",sans-serif">actors also used open-source tools for reconnaissance and vulnerability scanning for further investigation and exploitation and gain initial foothold into
a telecommunications organization or network service provider. </span><o:p></o:p></span></p>
<p class="MsoNoSpacing"><span class="normaltextrun"><span style="font-family:"Franklin Gothic Book",sans-serif"><o:p> </o:p></span></span></p>
<p class="MsoNoSpacing"><span class="normaltextrun"><span style="font-family:"Franklin Gothic Book",sans-serif">Executives and leaders at organizations of all sizes should ensure their teams apply the available patches to their systems, disable unnecessary
ports and protocols, replace end-of-life infrastructure, and implement a centralized patch management system. Read advisory for complete list of recommended mitigations.<o:p></o:p></span></span></p>
<p class="MsoNoSpacing"><o:p> </o:p></p>
<p class="MsoNoSpacing"><span style="font-family:"Franklin Gothic Book",sans-serif">NSA, CISA, and the FBI are urging U.S. and allied governments, critical infrastructure, and private industry organizations to review the advisory, be aware of the tactics and
techniques, and apply the recommended mitigations. The advisory provides a list of the most commonly exploited devices and CVEs along with an appendix of recommended mitigations
<span class="normaltextrun">tailored to observed tactics and techniques used by PRC cyber actors.</span><o:p></o:p></span></p>
<p class="MsoNoSpacing" style="margin-right:31.7pt;text-autospace:none"><span class="contextualspellingandgrammarerror"><o:p> </o:p></span></p>
<p class="MsoNoSpacing"><span style="font-family:"Franklin Gothic Book",sans-serif">CISA is posting information on our social media platforms. We appreciate you sharing this information and/or amplifying our social media with your community of followers.
<o:p></o:p></span></p>
<p class="MsoNoSpacing"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><b><span style="color:#1F497D">Theresa A. Masse<o:p></o:p></span></b></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#1F497D">Cyber Security Advisor, Region 10 (Oregon)
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#1F497D">Cybersecurity and Infrastructure Security Agency<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#1F497D">Department of Homeland Security<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#1F497D">Phone: (503) 930-5671
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#1F497D">Email:</span><span style="font-size:10.0pt;color:#777777">
</span><a href="mailto:theresa.masse@cisa.dhs.gov"><span style="font-size:10.0pt">theresa.masse@cisa.dhs.gov</span></a><u><span style="font-size:10.0pt;color:#0760C1"><o:p></o:p></span></u></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><img border="0" width="97" height="97" style="width:1.0138in;height:1.0138in" id="Picture_x0020_1" src="cid:image002.png@01D87A88.EE633690"><span style="color:#1F497D"><o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNoSpacing"><o:p> </o:p></p>
</div>
</body>
</html>